PT-2023-5338 · Apache · Apache Airflow Sqoop Provider

Happyhacking-K + 2 · Published 2023-08-25 · Updated 2024-09-27 · CVE-2023-27604

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow Sqoop Provider versions prior to 4.0.0

Description The issue is related to insufficient input validation, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by passing parameters with connections, making it possible to implement RCE attacks via sqoop import --connect, and obtain Airflow server permissions. The attacker needs to be logged in and have authorization to create or edit connections.

Recommendations To resolve the issue, upgrade to a version that is not affected, specifically version 4.0.0 or later. As a temporary workaround, consider restricting access to the sqoop import --connect command to minimize the risk of exploitation. Additionally, limit the ability to create or edit connections to authorized personnel only.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-05966

CVE-2023-27604

GHSA-G3M9-PR5M-4CVP

Affected Products

Apache Airflow Sqoop Provider

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-27604 · Security Note
• https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27604 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3m9-pr5m-4cvp · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05966 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/33039 · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1696109196230488408 · Twitter Post
• https://t.me/cvenotify/96427 · Telegram Post
• https://t.me/cvenotify/57438 · Telegram Post
• https://vuldb.com/?id.238045 · Note
• https://twitter.com/CVEnew/status/1696068357664002338 · Twitter Post
• https://twitter.com/oss_security/status/1695101996494409780 · Twitter Post
• https://t.me/cibsecurity/69275 · Telegram Post